CVE-2026-126933 · Package
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, compares file extensions with dots and letter case in a way that does not match its disabled-extensions list. Users with upload access can therefore store file types the administrator meant to block.
first public Sep 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Zipline 4.0.0 through 4.7.x instances that restrict uploads with the disabled extensions setting. Users with upload access, including unauthenticated folder uploaders where permitted, can bypass those restrictions. Instances that do not use disabled extensions, or that are on 4.8.0 or later, are not affected.
Not affected if no-disabled-extensions-configured, version-4.8.0-or-later
Who cares file-uploads, self-hosted, zipline
4.0.0 up to but not including 4.8.0 are affected.disabledExtensions setting and confirm whether uploads of those types succeed.4.8.0 or later.Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.